Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
164s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2022, 20:16
Behavioral task
behavioral1
Sample
8fc42e38478529fd7642fcf4bcee99cfed92e2e2d5d1fa4552c3255e713ff4fd.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8fc42e38478529fd7642fcf4bcee99cfed92e2e2d5d1fa4552c3255e713ff4fd.dll
Resource
win10v2004-20220812-en
General
-
Target
8fc42e38478529fd7642fcf4bcee99cfed92e2e2d5d1fa4552c3255e713ff4fd.dll
-
Size
81KB
-
MD5
e1f8c6beddd96fb99c637110345101a1
-
SHA1
d638f0e656ec96e13de048bd293d2bdc07897846
-
SHA256
8fc42e38478529fd7642fcf4bcee99cfed92e2e2d5d1fa4552c3255e713ff4fd
-
SHA512
36a5cc73484783105465d33f70bfeb0fe2dd9dd49f7c0873c6bb57adfada8b04290f1944b36574740db8f90ce32a6ea278c2cdf38c47fb1b4bc1aaef31e5711f
-
SSDEEP
1536:2GIlup9wNrigSBVSnxkhU+e7+xiqTAj2BJMgUFiRLA1uW2o9:2GLGdigSiG8zabNU8RLA1tP9
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4116 wrote to memory of 2348 4116 rundll32.exe 80 PID 4116 wrote to memory of 2348 4116 rundll32.exe 80 PID 4116 wrote to memory of 2348 4116 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8fc42e38478529fd7642fcf4bcee99cfed92e2e2d5d1fa4552c3255e713ff4fd.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8fc42e38478529fd7642fcf4bcee99cfed92e2e2d5d1fa4552c3255e713ff4fd.dll,#12⤵PID:2348
-